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19 | Plaintiff, DECLARATION OF SETH SCHOEN 
20 V. Case Consolidated with Case Nos.: 
1 2:12-cv-6636; 2:12-cv-6669; 2:12-cv- 
JOHN DOE, 6662; and 2:12-cv-6668 
22 
Defendant. Case Assigned to: 


hO 
eo) 


District Judge Otis D Wright, II 


NO 
a 


Discovery Referred to: 
Magistrate Judge Jacqueline Chooljian 


No WN 
NO NN 


Complaint Filed: September 27, 2012 
Trial Date: None set 


No ON 
oo ~~ 


Case No. 2:12-cv- DECLARATION OF SETH SCHOEN 
08333-ODW-JC 





Case 





2:12-cv-08333-ODW-JC Document119 Filed 04/17/13 Page 2of11 Page ID #:2802 


1 | DECLARATION OF SETH SCHOEN 
a | I, Seth Schoen, declare and state as follows: 
: ll. Iam a Senior Staff Technologist with the Electronic Frontier 
: | Foundation (EFF). I am over eighteen years of age. I make this declaration on my 
> | own personal knowledge and if called upon to testify thereto, I could and would 
=| competently do so. 
q M, I have worked with computers and computer networks for over a 
8 | decade. I have published two peer-reviewed academic papers in the field of computer 
? | security, and been interviewed about computer networking and computer security in 
“0 the national news media. I have testified about electronic communications systems in 
_ three courts and before the United States Sentencing Commission, and have 
2 | submitted expert testimony concerning the analysis of BitTorrent file-sharing 
= | networks to the federal courts in at least fifteen other matters. 
an ot I was requested by Morgan Pietz, counsel for a putative John Doe in the 
1D | above-captioned action, to research and provide an objective response to several 
16 | statements made in the Declaration of Joshua Chin in Support of Response to Order 
a to Show Cause, which was filed on April 8, 2013, and to factual assertions in the 
re oppositions to the Order to Show Cause. Specifically, I was asked to research and 
19 | respond to these issues: 
a0 | a. Whether the protocol described by Peter Hansmeier in his 
7 declaration in the above-captioned case is a reasonably accurate means of identifying 
cal the Internet Protocol (IP) addresses of computers involved in file-sharing using the 
*3-| BitTorrent protocol. 
a b. | Whether an incomplete download of a video file using BitTorrent 
2) | results in the downloader having a viewable copy of the file. 
26 c. What the metadata associated with the documents filed by the 
oa plaintiffs in this action reveal about who was involved in their drafting. 
28 
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4, In forming these opinions, I relied upon the Declarations of Peter 


| Hansmeier filed in the above-captioned case (ECF No. 8-1) and in case 2:12-06662- 
| ODW (ECF No. 6-1); Brett L. Gibbs’ Response to the Order to Show Cause in the 


above-captioned case (ECF No. 49); the Declaration of Joshua Chin in Support of 
Response to Order to Show Cause (ECF No. 108-1); the pleadings, declarations, and 


| exhibits filed in connection with the Court’s February 7, 2013 Order to Show Cause; 


| certain other pleadings filed in the above-captioned case and in the related cases, all 


of which were electronically filed on the CM/ECF system by Brett Gibbs’ CM/ECF 
account and are identified below; and the authorities I cite below. 

The Accuracy of Plaintiff’s Means of Identifying IP Addresses 

5. While the Hansmeier Declaration purports to describe the method by 
which the Plaintiffs in these consolidated cases identify the IP addresses of copyright 


infringers, the declarations omit information that I believe is material to a 


| determination of whether that method is reasonably accurate. 


6. For example, Mr. Hansmeier states that his software records the 


| “percent of the file downloaded by [his firm]’s software from the infringer’s 


computer” (Hansmeier Decl. at 20), but also that his firm’s software “does not [...] 


| allow me to [...] communicate with [the infringer’s] computer in any way” 


(Hansmeier Decl. at 21). It is thus unclear whether or to what extent the software 


| downloaded portions of the file from individual defendants, and Mr. Hansmeier did 


| not file this information with the Court, although he states that he has it on file 


(Hansmeier Decl. at 26). Similarly, it is unclear to what extent Mr. Hansmeier's 
software relied on information obtained from third-party BitTorrent trackers (which 


facilitate downloads) as opposed to information obtained by direct observation of 


| and communication with defendants’ computers. 


7 These omitted details could be important because simple methods of 


| attempting to locate copyright infringers can easily go awry. For example, in 2008, 


researchers from the University of Washington found that, given then-prevalent 
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| methods for investigating BitTorrent transfers, it was straightforward to frame 


| printer and succeeded in eliciting false allegations of copyright infringement against 


| on Hot Topics in Security, July 29, 2008, available at 
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| 25, and 26 of his declaration indicate that he filed with the Court only a small 


| Hansmeier says he “personally observed” infringing transmissions; his statement that 


| not actually participating in infringing filesharing activity, or that had not been 


| begins downloading a file, the BitTorrent client software receives pieces of the file 
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particular IP addresses for downloading files that they had not, in fact, ever 


attempted to download. The researchers experimentally framed their own laser 


it. See Michael Piatek, Tadayoshi Kohno, and Arvind Krishnamurthy, “Challenges 
and Directions for Monitoring P2P File Sharing Networks, or, Why My Printer 
Received a DMCA Takedown Notice,” in Proceedings of the 3rd USENIX Workshop 


http://Awww.usenix.org/event/hotsec08/tech/full _papers/piatek/piatek.pdf. 
8. I do not mean to suggest that Mr. Hansmeier is unable to gather or did 
not gather relevant information to support Plaintiff's allegations, including by 


techniques that avoid the pitfalls described by Piatek et al. However, paragraphs 20, 
summary portion of the information that he gathered. In paragraph 27, Mr. 


his firm's software does not “communicate” with Defendants’ computers leaves 
some ambiguity about the exact nature of this observation. 

9: Without more information about how Plaintiff gathers IP addresses and 
attribute infringing activity to them, it is my opinion that an investigation like 


Plaintiff's could result in the identification of IP addresses of computers that were 


directly confirmed to have done so. 
The Usability of Partial Downloads 
10. BitTorrent divides each file into “pieces,” which are subregions of the 


file that are downloaded independently of one another. When a BitTorrent user 


from many other BitTorrent clients on the Internet. These pieces do not arrive in 


order, as they would when using the Hypertext Transfer Protocol (HTTP) or File 
3 
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Transfer Protocol (FTP). Thus, at any given point during a BitTorrent download, the 


| user will have some portion of the data in the complete file, but that portion will 


almost certainly consist of pieces separated by numerous gaps. For example, when 


| downloading a ten-minute video file, a BitTorrent client may receive a few seconds 


of minute six, followed by a portion of minute two, and so on. At some point, if the 


| download progresses, the user will have a complete or substantially complete copy of 


the file. It is statistically unlikely that the user would have large contiguous portions 
of the video early in the download. 

11. An incomplete, interrupted BitTorrent download is often not useful to 
the downloader. For example, a partial video file containing gaps may be difficult to 
play through even if the majority of the file is present, both because the gaps may be 


disorienting to a human viewer and because they may cause computer software to 


| regard the file as damaged or corrupt and stop the playback process. 


12. Tagree with Mr. Chin that the VLC Player is powerful and that under 


some circumstances it may be used to play portions of incomplete or damaged files. 


| However, gaps in a video file (such as those caused by an incomplete BitTorrent 


download) could still interrupt the playback. 

13. More significantly, VLC cannot easily play certain video file formats if 
the beginning of the file is missing. 

14. Iconfirmed this by overwriting a small fraction of the beginning of a 


large video file with zero (null) bytes, which is the same condition as an incomplete 


| BitTorrent download that is missing the beginning of the file. VLC was not willing 
| to play this file when I pressed the “Play” button. Although an expert could use 


| VLC, possibly in combination with other software, to locate and play intact video 


data from later regions of the file, most users would probably consider this file 


| useless and unplayable. 


15. Because BitTorrent client software applications normally download 


| pieces of the file in a completely random order, it is quite possible, even common, 
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for the beginning of a file to be missing even when a significant fraction of the file's 


content has already been downloaded. This is an important contrast with other kinds 


of downloads where a file is downloaded sequentially from beginning to end, such as 


| an HTTP or FTP file download. Unlike these downloads, BitTorrent downloads do 


not happen in sequential order. 

16. Under the assumption that pieces are downloaded in a random order, 
there is a certain probability of having received at least a specified amount of data 
intact and contiguous at the beginning of the file. The probability of having at least 


the first b pieces of the file after downloading k out of n total pieces can be 


| calculated explicitly as 


1 where 


1X a x! 
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| is the “choose” function from probability, indicating the number of distinct ways of 


choosing y objects from a set of x objects. The general pattern is that this probability 


remains extremely low while a download is incomplete (even when a substantial 


| majority of the file has been downloaded), and then grows quickly as the download 


nears completion. 


17. For example, consider a 60-minute video file of 300 megabytes in size 


which is being distributed via a BitTorrent swarm. Suppose that the file has been 


divided into 1200 pieces of 256 kilobytes each. This graph shows the explicit 


| probability that a given downloader has obtained the first one minute (5 megabytes, 


| or twenty pieces) of contiguous video content, and hence can play through the first 
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minute of video without interruption, once the downloader has downloaded a 


specified number of pieces: 
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L | 18. Here is the corresponding graph for the ability to play the first 15 
2 seconds of this file (1.25 megabytes, or five pieces): 
3 
4 | Probability of At Least First 15 Seconds Intact 
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19 | 19. Ihave heard that some BitTorrent clients could be set to prioritize 
ae downloading the beginning of the file before other parts, but this is not, to my 
BE | knowledge, standard or default behavior in BitTorrent software because it would 
e have a deleterious effect on the speed and efficiency of a BitTorrent swarm as a 
23 4 
whole. 
zh | 20. According to the Hansmeier Declaration, Plaintiffs use “proprietary 
| forensic software to conduct an exhaustive real time ‘fingerprint’ of [a BitTorrent] 
a swarm.” Hansmeier Decl. § 20. This statement, as well as Mr. Hansmeier's 
a observation that “while [his firm] detects an infringement at a particular instant, the 
- | infringer may, and likely is infringing at other times as well” (id. { 21), suggests that 
7 
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| | Plaintiffs observe a swarm and a defendant’s participation in that swarm at a single 

2 moment in time. At any given moment, participants in the swarm will have 

3 | downloaded different amounts of data. 

4 21. Although Mr. Hansmeier states that “[o]nce obtaining a full version of 

° | the Video file, John Doe . . . shared pieces of that copyrighted Video file . . . with 

© | other individuals” (id. § 27), it is unclear from his declaration whether Mr. 

y | Hansmeier observed that any given Doe did in fact obtain a full version of the video 

5 | file, or whether Mr. Hansmeier was merely speculating that the Doe would 

2 eventually obtain a full version. His testimony at {21 that “6881 detects an 
” infringement at a particular instant” suggests that his statement at {| 27 about a 
| particular Doe “obtain[ing] a full version” is speculative. 
- 22. Many BitTorrent downloads fail to complete or are interrupted. Thus, 
= many of the computers observed to have a partial download at a given time will not 
complete the download and will not obtain a usable video file. Without more 
| information about how the Plaintiffs determine the nature and extent of a Doe 
MO defendant's downloading activity, it is my opinion that the investigation described in 
17 | the Hansmeier Declaration could result in the identification of IP addresses of 
" computers that did not download a usable video file. 
19 | 23.  Inhis declaration, Mr. Chin stated that “Use of the VLC Player has 
produced up to five seconds or more of images from a video file that had been the 
en subject of no more than thirty seconds of downloading.” However, Mr. Chin did not 
22 specify how the VLC Player was used in that instance, nor what protocol was used to | 
23 | download the file. A file downloaded using HTTP, FTP, or another protocol that 
es | downloads a file in linear fashion would, when interrupted, be more likely to result 
= in a file directly usable by an unskilled user. If Mr. Chin was referring to an 
ES interrupted BitTorrent download, it is likely that the playback he described required 
27 | more than simply pressing “Play” in the VLC Player. 
28 
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L | Authorship of Plaintiffs’ Filings 

2 'I 24. Portable Document Format (PDF) files can contain metadata, including 

: fields indicating the author’s name and the file’s creation and modification dates. 

= 25. Using the Xpdf software created by Glyph & Cog, LLG, I extracted the 

> | metadata from several PDF files that were electronically filed using Brett Gibbs’ 

| CM/ECF account in the above-titled case, and in a few of the related cases. 

a 26. My analysis revealed that the following files' were “created” by user 

8 | «gH01”: 

> | ¢ Memo iso P’s Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8- 
” 1, created Oct. 5, 2012) 
7 | ¢ Opposition to Ex Parte Application to Stay Pending Subpoena.pdf (ECF 
= No. 14, created November 30, 2012) 
¢ P’s Response to Ex Parte re Stay.pdf (ECF No. 16, created November 
a 30, 2012) 
Id | 27. My analysis revealed that the following files were “created” by user 
no “SH0S”: 
a | ¢ P's Ex Parte Appl for Expedited Discovery.pdf (ECF No. 8, created Oct. 
18 | 5, 2012) 
o ¢ P’s Response in Opposition to Movant’s Notice of Related Cases.pdf 
a0 (ECF No. 18, created Dec. 7, 2012) 
a ¢ P's Response in Opposition to Movant's Supplement to Notice of 
aa Related Cases Filed 12-14-12.pdf (ECF No. 21, created Dec. 14, 2012). 
= And in AF Holdings, LLC v John Doe, No. 12-cv-5709: 
¢ P’s Response to OSC.pdf (ECF No. 10, created Nov. 1, 2012) 
25 
26 | 1 The specific titles of these files were assigned when they were downloaded from the CM/ECF 
27 | system, however, I assume that the underlying PDF metadata is from the original file uploaded to 

| the CM/ECF system by the electronic filer, Brett Gibbs. Except where otherwise indicated, ECF 
28 | numbers are from 2:12-cv-8333. 
9 
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28. My analysis revealed that the following files were “created” by user 
“Paul”: 
¢ Ps Sanctions Motion.pdf (ECF No. 22, created Dec. 17, 2012) 
¢ P's Response to Anonymous Doe Movant's Ex Parte Appl for Leave to 
Take Early Discovery and Stay.pdf (ECF No. 27, created Dec. 20, 2012) 
¢ Motion to Disqualify Judge Wright.pdf (ECF No. 35, created Dec. 30, 
2012) 
¢ Opp to Request for Leave to File Response to Motion to Disqualify.pdf 
(ECF No. 39, created Jan. 7, 2013) 
¢ Notice of Voluntary Dismissal.pdf (ECF No. 43, created Jan. 28, 2013). 
And in AF Holdings, LLC v. John Doe, No. 12-cv-6636: 
¢ P’s Response re Failure to Serve.pdf (ECF No. 15, created Dec. 27, 
2012) 
And in AF Holdings, LLC v. Chaz Forsyth, No. 12-cv-6669: 
¢ P’s Response re Failure to Serve.pdf (ECF No. 18, created Dec. 27, 
2012) 


I declare under penalty of perjury under the laws of the United States of 


| America that the foregoing is true and correct. Executed on April 16, 2013 at San 


Francisco, California. 
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